You can use trusted headers to protect access to older applications that were developed internally.

Before you begin

You must be a Super Admin for the Cloud Administration Console to perform this task.

At least one identity router must be connected to the Cloud Authentication Service.

At least one identity source for the Cloud Authentication Service must be connected to the identity router.

Consult with a knowledgeable person at your site, such as an application web developer or support person, to learn what header information the application expects to receive. The application web server must be configured to check for headers and to prevent users from accessing the server without authenticating through RSA SecurID Access.

If you are using a custom image for the application portal icon, you need an image file in JPG or PNG format, and no larger than 50 KB. The recommended size is 75x75 pixels.

This configuration affects the entire deployment. All identity routers share these settings.

(Optional) In the Description field, enter a description for the application.

(Optional) To hide the application in the application portal, clear the Display in Portal checkbox. When unselected, the application is not visible in the application portal, but users can still access the application by going directly to the protected URL.

On the Proxy Settings page, specify a proxy web server. This proxy is the identity router. In most cases, you only need one proxied hostname for the identity router. You need multiple proxied hostnames only if the application communicates with other services. Click ADD and provide the following information.

Field

Setting

Protocol

The internet protocol for the web server: HTTP, HTTPS, or Both (HTTP/HTTPS)

If you add a web server that requires HTTP, select Enable HTTPS communication between user and identity router to improve security. This functionality is also known as SSL Termination. With this option selected, all HTTP traffic for this web server is redirected to HTTPS on the identity router. The identity router still uses HTTP to communicate with the web server.

Proxy Hostname

The hostname of the proxy web server, without the internet protocol, ending with your company domain name. Use a valid alias from the Domain Name System (DNS) database that points to the identity router hostname. This alias must be unique for each application.

Examples:

www-appname-com.sso.example.com

resources-appname-com.sso.example.com

Real Hostname

The true hostname where the application is located, without the internet protocol.

Examples:

www.appname.com

resources.appname.com

Port

The proxy port number. The default HTTP port is 80, and the default HTTPS port is 443. The port number is required for either HTTP or HTTPS, but is not required for Both (HTTP/HTTPS).

Rewrite Rules (Advanced)

(Optional) Click to define Apache HTTP Server rewrite rules.

Note: Do not configure rewrite rules unless instructed to do so by RSA Customer Support.

Provide the DNS administrator with a list of canonical name (CNAME) records. These records must be added to the DNS database before this application can use trusted headers. Each CNAME record points to the address (A) record for the hostname of the application portal. To generate this list, click Show CNAME Summary, and select one:

Click Hostname to show the hostname to which the CNAME record points.

Click BIND to show the Berkeley Internet Name Domain (BIND) format.

Copy the CNAME list and provide it to the DNS administrator.

In the Custom Headers section, select the information to pass in headers to the application.

Note: Do not configure rewrite rules unless instructed to do so by RSA Customer Support.

Click Next Step

On the User Access page, select an access policy that determines which users can access the application in the application portal, and whether those users must perform step-up authentication in order to use the application.

Select one of the following:

Allow All Authenticated Users – Allow all users signed into the application portal to access the application with no step-up authentication required. This is a built-in access policy that you cannot modify.

Select Custom Policy – Select a custom access policy from the drop-down list. The default is No Access Allowed, which denies access to all users. No Access Allowed is a built-in access policy that you cannot modify.

Click Next Step.

Click Next Step.

On the Portal Display page, configure how the application will appear in the application portal.

(Optional) To hide the application in the application portal, clear the Display in Portal checkbox. When unselected, the application is not visible in the application portal, but users can still access the application by going directly to the protected URL.

Select the Application Icon to represent the application in the RSA SecurID Access Application Portal. Use the default icon or click Change Icon to upload a different image.

In the Application Tooltip field, specify tooltip text to display when the user passes the cursor over the application icon.

In the Portal URL field, enter the URL where the user will be directed after clicking an application icon. Replace the real name of the application with the proxied hostname, and specify the application page that you want users to reach.